Mautic has an XSS in contact tracking and page hits report
Impact
Prior to this patch, a stored XSS vulnerability existed in the contact tracking and page hits report.
Source excerpt · OSVAffected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
| Affected range | Recorded fix |
|---|---|
| From 1.0.0-beta4 before 4.4.13Ecosystem versions | 4.4.13 |
| From 5.0.0-alpha before 5.1.1Ecosystem versions | 5.1.1 |
Version evidence: OSV · GHSA-xpc5-rr39-v8v2
View original version evidence (44 explicit versions)
| Affected range | Recorded fix |
|---|---|
| From 1.0.0-beta4 before 4.4.13Ecosystem versions | 4.4.13 |
| From 5.0.0-alpha before 5.1.1Ecosystem versions | 5.1.1 |
Version evidence: OSV · GHSA-xpc5-rr39-v8v2
View original version evidence (159 explicit versions)
Original source description
Summary
Prior to this patch, a stored XSS vulnerability existed in the contact tracking and page hits report.
Patches
Please update to 4.4.13 or 5.1.1 or later.
Workarounds
None
References
https://owasp.org/www-project-top-ten/2017/A7_2017-Cross-Site_Scripting_(XSS) https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/07-Input_Validation_Testing/02-Testing_for_Stored_Cross_Site_Scripting
If you have any questions or comments about this advisory:
Email us at security@mautic.org
References
- Security advisory github.com/mautic/mautic/security/advisories/GHSA-xpc5-rr39-v8v2
- Security advisory nvd.nist.gov/vuln/detail/CVE-2021-27917
- Patch github.com/mautic/mautic/commit/550e33562d03363f7592fa9354259787a23a1d98
- Patch github.com/mautic/mautic/commit/629165ac905c53bbb44feb5a6dbadb1dfd6d5564
- Source reference github.com/mautic/mautic